Tag: flaw
-
New Citrix Zero-Day Vulnerability Allows Remote Code Execution
watchTowr has found a flaw in Citrix’s Session Recording Manager that can be exploited to enable unauthenticated RCE against Citrix Virtual Apps and Desktops First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/new-citrix-zeroday-vulnerability/
-
Microsoft Warns of Chinese Botnet Exploiting Router Flaws for Credential Theft
Microsoft has revealed that a Chinese threat actor it tracks as Storm-0940 is leveraging a botnet called Quad7 to orchestrate highly evasive password … First seen on thehackernews.com Jump to article: thehackernews.com/2024/11/microsoft-warns-of-chinese-botnet.html
-
HPE Issues Urgent Patches for Critical Vulnerabilities in Aruba Networking Access Points
Hewlett Packard Enterprise (HPE) has issued critical security patches to address several vulnerabilities affecting its Aruba Networking Access Point products. These vulnerabilities (CVE-2024-42509 and CVE-2024-47460), including two particularly severe flaws, could allow unauthenticated attackers to execute arbitrary commands remotely, potentially compromising the security of affected systems. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/hpe-security-patches-cve-2024-42509/
-
Dell Enterprise SONiC Flaw Let Attackers Hijack the System
Dell Technologies has disclosed multiple critical security vulnerabilities in its Enterprise SONiC OS, which could allow attackers to gain control of affected systems. These vulnerabilities, identified through the Common Vulnerabilities and Exposures (CVE) system, are critical and affect Dell Enterprise SONiC OS versions 4.1.x and 4.2.x. Dell urges users to upgrade their systems immediately to…
-
Google Chrome Users at Risk: CERT-In Advises Urgent Update to Fix Security Flaws
The Indian Computer Emergency Response Team (CERT-In) has issued a warning about newly discovered First seen on thecyberexpress.com Jump to article: thecyberexpress.com/vulnerabilities-in-google-chrome/
-
Microsoft Bookings Flaw Enables Account Hijacking and Impersonation
A vulnerability in Microsoft Bookings can expose your organization to serious security risks. Learn how attackers can exploit… First seen on hackread.com Jump to article: hackread.com/microsoft-bookings-flaw-account-hijack-impersonate/
-
Veeam Patches High-Severity Vulnerability as Exploitation of Previous Flaw Expands
Veeam has released a hotfix for a high-severity authentication bypass vulnerability in Backup Enterprise Manager. The post Veeam Patches High-Severity Vulnerability as Exploitation of Previous Flaw Expands appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/veeam-patches-high-severity-vulnerability-as-exploitation-of-previous-flaw-expands/
-
Many Legacy D-Link NAS Devices Exposed to Remote Attacks via Critical Flaw
D-Link warns of a critical-severity command injection vulnerability impacting multiple discontinued NAS models. The post Many Legacy D-Link NAS Devices Exposed to Remote Attacks via Critical Flaw appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/many-legacy-d-link-nas-devices-exposed-to-remote-attacks-via-critical-flaw/
-
Security Flaws in Popular ML Toolkits Enable Server Hijacks, Privilege Escalation
Cybersecurity researchers have uncovered nearly two dozen security flaws spanning 15 different machine learning (ML) related open-source projects.These comprise vulnerabilities discovered both on the server- and client-side, software supply chain security firm JFrog said in an analysis published last week.The server-side weaknesses “allow attackers to hijack important servers in the First seen on thehackernews.com Jump…
-
HPE Issues Critical Security Patches for Aruba Access Point Vulnerabilities
Hewlett Packard Enterprise (HPE) has released security updates to address multiple vulnerabilities impacting Aruba Networking Access Point products, including two critical bugs that could result in unauthenticated command execution.The flaws affect Access Points running Instant AOS-8 and AOS-10 -AOS-10.4.x.x: 10.4.1.4 and belowInstant AOS-8.12.x.x: 8.12.0.2 and belowInstant AOS-8.10.x.x: First seen on thehackernews.com Jump to article: thehackernews.com/2024/11/hpe-issues-critical-security-patches.html
-
LiteSpeed Cache Plugin Vulnerability Poses Significant Risk to WordPress Websites
A high-severity security flaw has been disclosed in the LiteSpeed Cache plugin for WordPress that could allow an unauthenticated threat actor to eleva… First seen on thehackernews.com Jump to article: thehackernews.com/2024/10/litespeed-cache-plugin-vulnerability.html
-
Security Affairs newsletter Round 497 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Mazda Connect flaws allow to hack some Mazda vehicles Veeam Backup & Replication exploit reused in new Frag…
-
Week in review: Zero-click flaw in Synology NAS devices, Google fixes exploited Android vulnerability
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Millions of Synology NAS devices vulnerable to zero-click attacks … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/11/10/week-in-review-zero-click-flaw-in-synology-nas-devices-google-fixes-exploited-android-vulnerability/
-
Veeam Backup Replication exploit reused in new Frag ransomware attack
A critical flaw, tracked as CVE-2024-40711, in Veeam Backup & Replication (VBR) was also recently exploited to deploy Frag ransomware. In mid-October, Sophos researchers warned that ransomware operators are exploiting the critical vulnerabilityCVE-2024-40711in Veeam Backup & Replication to create rogue accounts and deploy malware. In early September 2024, Veeamreleasedsecurity updates to address multiple vulnerabilities impacting…
-
Feds Warn Health Sector of an Array of Cyberthreats
HHS Alerts on Scattered Spider, Living of the Land, Miracle Exploit, F5 Attacks. Federal authorities are warning the healthcare sector of an array of cyberthreats – including Scattered Spider hacks, living-off-the-land attacks, and bad actors looking to exploit weaknesses such as F5 misconfigurations and also so-called Miracle Exploit flaws in some Oracle software. First seen…
-
Synology fixed critical flaw impacting millions of DiskStation and BeePhotos NAS devices
Synology addressed a critical vulnerability in DiskStation and BeePhotos NAS devices that could lead to remote code execution. Taiwanese vendor Synolo… First seen on securityaffairs.com Jump to article: securityaffairs.com/170602/hacking/synology-fixed-critical-bug-in-diskstation-and-beephotos-nas.html
-
CISA Warns of Active Attacks on Critical Palo Alto Exploit
Tags: advisory, attack, cisa, cybersecurity, exploit, flaw, infrastructure, network, technology, vulnerabilityCISA Adds Critical Palo Alto Flaw to Vulnerability Catalog After Attack Discovery. The Cybersecurity and Infrastructure Security agency warned Palo Alto Networks that a critical vulnerability the technology giant previously patched has been actively exploited since then, according to a new advisory, potentially exposing configuration secrets and credentials. First seen on govinfosecurity.com Jump to article:…
-
Critical Veeam RCE bug now used in Frag ransomware attacks
After being used in Akira and Fog ransomware attacks, a critical Veeam Backup & Replication (VBR) security flaw was also recently exploited to deploy Frag ransomware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-veeam-rce-bug-now-used-in-frag-ransomware-attacks/
-
Palo Alto Networks warns of potential RCE in PAN-OS management interface
Palo Alto Networks warns customers to restrict access to their next-generation firewalls because of a potential RCE flaw in the PAN-OS management interface. Palo Alto Networks warns customers to limit access to their next-gen firewall management interface due to a potential remote code execution vulnerability in PAN-OS. The cybersecurity company has no further details on…
-
D-Link won’t fix critical flaw affecting 60,000 older NAS devices
More than 60,000 D-Link network-attached storage devices that have reached end-of-life are vulnerable to a command injection vulnerability with a publicly available exploit. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/d-link-wont-fix-critical-flaw-affecting-60-000-older-nas-devices/
-
Intel sued over Raptor Lake voltage instability
Failure to warn customers about chip flaw leads to fraud claim First seen on theregister.com Jump to article: www.theregister.com/2024/11/06/intel_sued_over_raptor_lake_chips/
-
Ivanti zero-day vulnerabilities exploited in chained attack
The new exploit chains targeting Ivanti Cloud Service Application customers are connected to a previously disclosed critical path traversal flaw, CVE-… First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366613041/Ivanti-zero-day-vulnerabilities-exploited-in-chained-attack
-
AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services
Tags: access, botnet, cloud, credentials, exploit, flaw, infrastructure, Internet, iot, malware, remote-code-execution, service, threat, vulnerabilityThe threat actors behind the AndroxGh0st malware are now exploiting a broader set of security flaws impacting various internet-facing applications, while also deploying the Mozi botnet malware.”This botnet utilizes remote code execution and credential-stealing methods to maintain persistent access, leveraging unpatched vulnerabilities to infiltrate critical infrastructures,” CloudSEK said in a First seen on thehackernews.com Jump…
-
Germany drafts law to protect researchers who find security flaws
The Federal Ministry of Justice in Germany has drafted a law to provide legal protection to security researchers who discover and responsibly report s… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/germany-drafts-law-to-protect-researchers-who-find-security-flaws/
-
Palo Alto Networks Expedition Vulnerability Exploited in Attacks, CISA Warns
CISA has added a Palo Alto Networks Expedition flaw tracked as CVE-2024-5910 to its Known Exploited Vulnerabilities Catalog. The post Palo Alto Networks Expedition Vulnerability Exploited in Attacks, CISA Warns appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/palo-alto-networks-expedition-vulnerability-exploited-in-attacks-cisa-warns/
-
New Research Reveals Spectre Vulnerability Persists in Latest AMD and Intel Processors
More than six years after the Spectre security flaw impacting modern CPU processors came to light, new research has found that the latest AMD and Inte… First seen on thehackernews.com Jump to article: thehackernews.com/2024/10/new-research-reveals-spectre.html
-
CISA Warns of Critical Palo Alto Networks Vulnerability Exploited in Attacks
Tags: access, attack, cisa, control, cve, cyber, cybersecurity, exploit, flaw, infrastructure, network, tool, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns organizations of a critical vulnerability in Palo Alto Networks’ Expedition tool, which could lead to severe security breaches. The vulnerability, CVE-2024-5910, is classified as a >>Missing Authentication
-
CISA Alerts to Active Exploitation of Critical Palo Alto Networks Vulnerability
Tags: authentication, cisa, cve, cybersecurity, exploit, flaw, infrastructure, kev, network, tool, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a now-patched critical security flaw impacting Palo Alto Networks Expedition to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.The vulnerability, tracked as CVE-2024-5910 (CVSS score: 9.3), concerns a case of missing authentication in the Expedition migration tool that First seen on…
-
Over 700M EA user accounts exposed by critical account system flaw
First seen on scworld.com Jump to article: www.scworld.com/brief/over-700m-ea-user-accounts-exposed-by-critical-account-system-flaw